00. Changelog v2.3.0 — September 2026 Major release — AmneziaWG anti-censorship stealth WireGuard protocol, strict protocol package validation, reactive multi-tab network interface, and expanded REST API. AmneziaWG Protocol Support (Anti-Censorship & DPI Bypass) Full integration of AmneziaWG — a modified WireGuard protocol engineered to evade Deep Packet Inspection (DPI) and strict firewall censorship: Stealth Obfuscation — randomized magic headers (H1, H2, H3, H4) replace standard WireGuard packet headers, defeating protocol fingerprinting Junk Packet Padding — configurable junk packets (Jc count, Jmin/Jmax size range, S1/S2 sizes) injected during handshake to mask traffic patterns Per-Network & Global Defaults — configure default obfuscation parameters globally, with optional per-network custom overrides One-Click Client Provisioning — generate AmneziaWG configs and QR codes directly from the client management interface Dual-Stack & Bandwidth Control — supports IPv4/IPv6 dual-stack addressing and HTB bandwidth traffic shaping Diagnostics & Monitoring — live awg show status, peer handshake inspection, and real-time bandwidth metrics Protocol Package Validation & Safety Prevents enabling VPN protocols whose underlying system packages are not installed: Environment Verification — checks for wireguard / wireguard-tools, amneziawg / amneziawg-tools, openvpn, and strongswan Network Form Guard — network settings validate installed packages before allowing a protocol to be activated API Error Mapping — returns structured, field-mapped error messages highlighting the exact protocol input in the web UI Reactive Multi-Tab Network Interface Seamless AJAX experience when managing networks with multiple VPN protocols: Dynamic Tabs — toggling a protocol checkbox in the main settings tab instantly creates or removes the corresponding protocol tab in the DOM Multi-Tab AJAX Update — clicking Save commits the network settings and automatically reloads data across all active protocol tabs without a full page reload Zero Page Disruption — preserve user input and navigation state across tabs REST API & OpenAPI 3.0.3 Expansion 170+ REST API Endpoints — full coverage for WireGuard, AmneziaWG, OpenVPN, IKEv2, firewall, DNS, and diagnostics Full Swagger Documentation — updated OpenAPI 3.0.3 schema with AmneziaWG parameters and response models v2.1.1 — March 2026 Patch release — client bandwidth fix and OpenVPN session stability improvements. Client Bandwidth Fix Fixed an issue where per-client bandwidth limits were ignored during client creation: Root cause: when a network had default bandwidth limits configured, they always overwrote client-specified values — even when the user explicitly set a custom bandwidth Fix: network bandwidth is now used only as a default when the client has no custom value (0 / not specified). Client-specified bandwidth always takes priority Impact: custom per-client bandwidth limits now work correctly on creation OpenVPN Session Stability Client operations (add, edit, delete) no longer restart the OpenVPN server, preserving all active sessions: Client Add — generates certificates, updates CCD and password files without restarting OpenVPN (re-read on next client connect) Client Edit — updates CCD and password files only, no restart needed Client Delete — revokes certificate and updates CCD/password files, CRL is re-read automatically Management socket — added per-network OpenVPN management socket for targeted client disconnect DisconnectAllProtocols — new function that disconnects a specific client from WireGuard, OpenVPN, and IKEv2 simultaneously. Called when a client is disabled or deleted Firewall ordering — WaitForOvpnInterface() ensures tun interfaces are up before committing policy routing after any OpenVPN restart Documentation DNS page — rewritten documentation with new screenshots for all three tabs (Settings, Records, Ad Blocking) v2.1.0 — March 2026 Feature release — DNS-based ad blocking for all VPN clients, plus stability improvements. DNS Ad Blocking Built-in ad and tracker blocking via bind9 Response Policy Zone (RPZ): Block ads and trackers for all VPN clients at the DNS level — no client-side software needed 4 built-in block lists — Steven Black Unified (~130k domains), OISD Small (~70k), Pete Lowe (~3k), Hagezi Multi Pro (~170k) Custom lists — add any blocklist URL (supports hosts format, domain-per-line, wildcard, and adblock filter format) Whitelist — exclude specific domains from blocking (including all subdomains) Auto-update — block lists are refreshed automatically every 24 hours Per-list toggle — enable/disable individual lists without deleting them Statistics — total blocked domains count, per-list domain count, last update timestamp Zero client configuration — works automatically for all clients using the built-in DNS server Separate RPZ zone — ad blocking uses its own zone (rpz.adblock), independent of static DNS records Metric Value Default blocked domains ~130,000+ With all lists enabled ~250,000+ Update frequency Every 24 hours Supported formats hosts, domain-per-line, wildcard, adblock filter New API endpoints: Method Endpoint Description GET /dns/adblock Get ad blocking configuration PUT /dns/adblock Enable/disable, toggle lists POST /dns/adblock/update Force update block lists POST /dns/adblock/lists Add custom block list DELETE /dns/adblock/lists/{name} Delete custom list GET /dns/adblock/whitelist List whitelisted domains POST /dns/adblock/whitelist Add domain to whitelist DELETE /dns/adblock/whitelist/{name} Remove from whitelist DNS Page Redesign The DNS configuration page now uses a tabbed layout: Settings tab — DNS server configuration (forwarders, TTL, ACL) Records tab — static DNS records (RPZ overrides) Ad Blocking tab — enable/disable, manage block lists and whitelist OpenVPN Startup Fix Fixed a race condition where OpenVPN clients could lose internet connectivity after server restart: Root cause: policy routing rules were committed before OpenVPN tunnel interfaces were fully initialized Fix: replaced fixed 500ms delay with a polling loop (up to 10 seconds) that waits for all OpenVPN tun interfaces to appear before committing firewall and routing rules Impact: eliminates intermittent "no internet" issues for OpenVPN clients after system restart Other Improvements Client creation simplified — only network_name is required; name, username, password, and ipv4 are auto-filled from suggested data Client fields renamed — allowed_IPs / allowed_IPs_ipv6 replaced with cleaner ipv4 / ipv6 field names (backward-compatible migration) OpenAPI documentation — 8 new endpoints documented for DNS ad blocking (156+ total) v2.0.0 — March 2026 Major release — complete rewrite with new architecture, third VPN protocol, and dozens of new features. New Architecture: Network → Client → Protocol The core data model has been redesigned from the ground up: Networks replace the old per-server configuration — each network has its own subnet, protocol settings, firewall, bandwidth limits, and upstream Clients belong to a network and inherit its settings — one client, one IP address, all protocols Protocols are configured per-network: enable or disable WireGuard, OpenVPN, and IKEv2 independently for each network This architecture allows running multiple isolated VPN networks on a single server, each with completely different configurations. OpenVPN Support PUQVPNCP now supports three VPN protocols simultaneously: Protocol New in v2.0 WireGuard Updated — now per-network OpenVPN New — full support with PKI, certificates, custom config IKEv2/IPsec Updated — now per-network OpenVPN features include: TLS/SSL security with configurable cipher suites Built-in certificate management (Root CA, Server, Client certificates) Custom server and client configuration directives Connection logging and real-time status Certificate revocation and renewal Automatic .ovpn configuration file generation Upstream WireGuard Tunnels Route network traffic through external WireGuard VPN servers: Import configuration — paste a standard WireGuard .conf file to create an upstream Per-network routing — assign different upstreams to different networks Geographic IP rotation — clients appear from different countries depending on their network Multi-hop privacy — add an extra encryption layer between your server and the internet System upstreams — view and manage all WireGuard tunnel interfaces on the system Diagnostics & Environment Integrity New real-time diagnostics system for monitoring server health: VPN Protocol Status — WireGuard interfaces, OpenVPN processes, strongSwan IKE SAs DNS & Monitoring — bind9 status, rsyslog, telegraf, InfluxDB connectivity Network Configuration — per-network checks: interfaces up, routes configured, firewall chains loaded, traffic control active Integrity Check — verifies that all system-level configurations match the panel's expected state Real-time logs — view system and VPN service logs directly from the web interface Per-Network Firewall Each network now has its own firewall chain set: Filter rules — control traffic flow within and between networks NAT rules — source/destination NAT per network DNAT rules — port forwarding to specific clients Mangle rules — packet marking for advanced routing and QoS ipset integration — automatic IP sets per network for high-performance matching Global settings — client isolation and peering rules at the system level Role-Based Access Control (RBAC) Fine-grained permission system replacing the old single-admin model: Permission Groups — create custom groups with granular access (36+ permissions) Multi-user — multiple administrators with different access levels Default groups: admin (full access), operator (all except system settings), viewer (read-only) API Tokens — create tokens with IP restrictions, expiration dates, and user association Session security — IP-pinned sessions with configurable timeout Traffic Control & Bandwidth Per-network and per-client bandwidth management: Network-level limits — set download/upload bandwidth caps for the entire network Client-level limits — override per-client with individual bandwidth settings Traffic classes — tc (Linux Traffic Control) integration for precise QoS Real-time stats — view live throughput, drops, overlimits per client Daily breakdown — traffic statistics aggregated by day with network/client granularity Network Peering Allow communication between VPN networks on the same server: Pair-based peering — select which networks can communicate with each other Automatic routing — firewall and routing rules are generated automatically Apply/revert — review changes before applying, revert if needed Isolation by default — networks are fully isolated unless peering is explicitly configured One-Time Links (OTL) Self-service configuration links for all three protocols: WireGuard — QR code + downloadable .conf file OpenVPN — downloadable .ovpn profile with embedded certificates IKEv2 — downloadable .mobileconfig (iOS/macOS) or connection instructions Configurable defaults — set which protocols are shown, branding, expiration Single-use or time-limited — links expire after first use or a configured time REST API Expansion The API has been completely rewritten and expanded: Metric v1.x v2.0 Endpoints ~30 148+ Documentation None OpenAPI 3.0 Authentication Single hash Bearer tokens + RBAC Swagger UI No Yes (/api_docs) New API areas: Networks, Clients, OpenVPN, Upstreams, Peering, Firewall, Diagnostics, Permission Groups, System Users, Profile management. UI & Theme Dark / Light / Auto — full theme support with system preference detection Bootstrap 5.3 — modern responsive design AJAX everywhere — all operations via REST API, no page reloads DataTables — sortable, searchable tables with responsive layout Toastr notifications — real-time feedback for all actions Lightbox images — click to enlarge screenshots in documentation Other Improvements Let's Encrypt auto-SSL — automatic HTTPS certificate management Port forwarding — forward external ports to specific VPN clients Custom routes — push routes to clients per-network Per-network DNS — configure DNS servers per network Backup to FTP — automatic backup upload to remote FTP server InfluxDB + Grafana — export traffic metrics for external dashboards Single binary — ~34MB Go binary with all assets embedded, no runtime dependencies Systemd integration — clean service management with auto-restart Migration from v1.x PUQVPNCP v2.0 is a ground-up rewrite and is not directly upgradeable from v1.x. Key differences: Aspect v1.x v2.0 Architecture Account → WireGuard Server Network → Client → Protocol Protocols WireGuard + IKEv2 WireGuard + OpenVPN + IKEv2 Auth Single admin + API hash Multi-user + RBAC + API tokens Firewall Global rules Per-network chains API ~30 endpoints, no docs 148+ endpoints, OpenAPI 3.0 UI jQuery + page reloads Bootstrap 5 + AJAX For migration assistance, see Troubleshooting or contact PUQ Support.